Overview

overview

10

Static

static

8

PO 2023-03...SA.doc

windows10-1703-x64

10

Analysis

  • max time kernel
    13s
  • max time network
    70s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    01-06-2023 09:34

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    PO 2023-03-08_1201, USA.doc

  • Size

    514.3MB

  • MD5

    2103ad02afba454f7e3bc79bd2d230c6

  • SHA1

    c939759d733481f1912fa2bfed192b0b8551545f

  • SHA256

    7fa43c67c2ae59cca2cc80f81469ebce48b8f6910e2c9d62f307bd5534c0e86e

  • SHA512

    c487461dee8f02f32b2be83a06d0beea8366677750eb88a807e787e5a9744712215fbc7d592eb84c604ab56460472eb5f57ccc1d1fa99bceaef781dbb3d01d84

  • SSDEEP

    3072:2JX29m8QBUoItA/leC6gSJ+2JiclnUOvrRxqmLcHeNJxPkdVdTRcDK6:2EmleC6gSJWclU0RxVLcHe5cdTR

Score
10/10
emotetepoch4bankertrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

164.68.99.3:8080

164.90.222.65:443

186.194.240.217:443

1.234.2.232:8080

103.75.201.2:443

187.63.160.88:80

147.139.166.154:8080

91.207.28.33:8080

5.135.159.50:443

153.92.5.27:8080

213.239.212.5:443

103.43.75.120:443

159.65.88.10:8080

167.172.253.162:8080

153.126.146.25:7080

119.59.103.152:8080

107.170.39.149:8080

183.111.227.137:8080

159.89.202.34:443

110.232.117.186:8080
eck1.plain
ecs1.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Script User-Agent 4 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\PO 2023-03-08_1201, USA.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:4196
    • C:\Windows\System32\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\113635.tmp"
      2⤵
      • Process spawned unexpected child process
      PID:924

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\113635.tmp
    Filesize

    293.8MB

    MD5

    9e7cb92436c812d9401dddeb39815a57

    SHA1

    bd276ab75804bcb424f98a1f46cced163a37266e

    SHA256

    64cecedb0118729570fcd6c738362714f9a42f471c4f0fdcac6c96b1313c0724

    SHA512

    d12627f5bd9eb6daa62eac296b3ee7fe9d78d15fe93c05bcd7346a5465d08e18b41b027a706c2ca5893f005e0d154f8599016359156f2c955ef95a6340090de7

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\113639.zip
    Filesize

    821KB

    MD5

    f1ec7bd22e219fdb389f5e2a0a8132df

    SHA1

    fe8cf0aa2da1a147024c82ac45989795e5b467e0

    SHA256

    8582757782e4048ba84898de0953c7c9710d84c2e764d1fca8b1d393c436dbc8

    SHA512

    2b77027da8f0811f7cfc3735e579c4fd7e3506d85fa78ad667e88bd43dc0ab376d2b8b0c6aab3d35678810a9ee6e589b93d60aa481239ad3acf91cadc88f4969

    Download Submit
  • \Users\Admin\AppData\Local\Temp\113635.tmp
    Filesize

    289.2MB

    MD5

    902b5244b4955c8fa6b3799e72d95446

    SHA1

    79139e934f7ea9a355b9f686fdd841178619aaa7

    SHA256

    9c74f8e8498d351c9d8485e5ee72fd01258759fc399b2a155c272e2a3e046bb9

    SHA512

    597cb2050ee15d21dd88f1ca99a71aab6e6d24c1c99ed388ab106ca521ee9bf52091d77c151058e46efe702bff6138033f3e7c05c9e9aab0cad111bbab3fe148

    Download Submit
  • memory/924-339-0x00000000008C0000-0x00000000008C1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/924-336-0x0000000180000000-0x000000018002D000-memory.dmp
    Filesize

    180KB

    Download
  • memory/4196-120-0x00007FFF8E130000-0x00007FFF8E140000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4196-121-0x00007FFF8E130000-0x00007FFF8E140000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4196-122-0x00007FFF8E130000-0x00007FFF8E140000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4196-123-0x00007FFF8E130000-0x00007FFF8E140000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4196-126-0x00007FFF8A5C0000-0x00007FFF8A5D0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4196-127-0x00007FFF8A5C0000-0x00007FFF8A5D0000-memory.dmp
    Filesize

    64KB

    Download